Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Wizard Spider (threat actor)
Risk
93
Critical
82 techniques 53 tools/malware 4 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
11
T1583
Acquire Infrastructure resource development
T1583.001
Domains resource development
T1583.003
Virtual Private Server resource development
T1583.004
Server resource development
T1584
Compromise Infrastructure resource development
T1584.001
Domains resource development
T1584.003
Virtual Private Server resource development
T1584.004
Server resource development
T1585.002
Email Accounts resource development
T1588.002
Tool resource development
T1588.003
Code Signing Certificates resource development
›
3 Delivery
2
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
12
T1047
Windows Management Instrumentation execution
T1053.005
Scheduled Task execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1106
Native API execution
T1204.001
Malicious Link execution
T1204.002
Malicious File execution
T1569.002
Service Execution execution
CVE CVE-2025-55182
CVE CVE-2025-60787
CVE CVE-2025-8518
CVE CVE-2026-31431
›
5 Installation
24
T1003.001
LSASS Memory credential access
T1003.002
Security Account Manager credential access
T1003.003
NTDS credential access
T1552.006
Group Policy Preferences credential access
T1555.004
Windows Credential Manager credential access
T1557.001
Name Resolution Poisoning and SMB Relay credential access
T1558.003
Kerberoasting credential access
T1016
System Network Configuration Discovery discovery
T1018
Remote System Discovery discovery
T1033
System Owner/User Discovery discovery
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1087.002
Domain Account discovery
T1135
Network Share Discovery discovery
T1482
Domain Trust Discovery discovery
T1518.001
Security Software Discovery discovery
T1518.002
Backup Software Discovery discovery
T1133
External Remote Services persistence
T1136.001
Local Account persistence
T1136.002
Domain Account persistence
T1543.003
Windows Service persistence
T1547.001
Registry Run Keys / Startup Folder persistence
T1547.004
Winlogon Helper DLL persistence
›
6 Command & Control
15
T1005
Data from Local System collection
T1074
Data Staged collection
T1074.001
Local Data Staging collection
T1560.001
Archive via Utility collection
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
T1571
Non-Standard Port command and control
T1021
Remote Services lateral movement
T1021.001
Remote Desktop Protocol lateral movement
T1021.002
SMB/Windows Admin Shares lateral movement
T1021.006
Windows Remote Management lateral movement
T1210
Exploitation of Remote Services lateral movement
T1550.002
Pass the Hash lateral movement
T1570
Lateral Tool Transfer lateral movement
›
7 Actions on Objectives
22
T1112
Modify Registry defense impairment
T1222.001
Windows Permissions defense impairment
T1553.002
Code Signing defense impairment
T1685
Disable or Modify Tools defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1048.003
Exfiltration Over Unencrypted Non-C2 Protocol exfiltration
T1567.002
Exfiltration to Cloud Storage exfiltration
T1485
Data Destruction impact
T1486
Data Encrypted for Impact impact
T1489
Service Stop impact
T1490
Inhibit System Recovery impact
T1491
Defacement impact
T1027
Obfuscated Files or Information stealth
T1027.010
Command Obfuscation stealth
T1036.004
Masquerade Task or Service stealth
T1055
Process Injection stealth
T1055.001
Dynamic-link Library Injection stealth
T1070.004
File Deletion stealth
T1078
Valid Accounts stealth
T1078.002
Domain Accounts stealth
T1197
BITS Jobs stealth
T1218.011
Rundll32 stealth
Stage risk: Critical High Medium None

Tools & Malware (53)

AdFind Akira Anchor AppleJeus BASTA ransomware Bazar BazarBackdoor Beacon Black Basta Black Basta ransomware BlackByte Carbanak Cobalt Cobalt Strike Cobalt Strike Cobalt Strike - S0154 Cobalt Strike BEACON Conti Conti Conti Ransomware Dark Diavol Dyre Emotet Global GrimAgent Hafnium Hive IcedID Kimsuky LockBit Machete MuddyWater Naikon Nltest Payload Payload PowerShell Ryuk Ryuk Ransomware STOP SocGholish SystemBC TrickBot Trojan Turla VOLTZITE Void Volt Typhoon Winnti metasploit phishing route

Indicators of Compromise (40)

Domain
cisa.gov TEMP.Veles datasecuritytoday.com Salesforce.com NLog.config tbd.TITLE.Connect Ransom.Conti airloweryd.com +19 more
Email Address
info@redcanary.com rocke@live.cn
Filename
taskeng.exe regsvr32.exe wscpy.exe mshta.exe nltest.exe boxDeling.hta ntdsAudit.exe serhosts.exe +3 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

36 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (13)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +8 more
Installation (21)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1025 Privileged Process Integrity +16 more
Command & Control (18)
M1016 Vulnerability Scanning M1018 User Account Management M1019 Threat Intelligence Program M1026 Privileged Account Management M1027 Password Policies +13 more
Actions on Objectives (25)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +20 more

Detection Coverage

82 strategies
6/7 stages covered

Weaponization (11)

DET0835 Detection of Email Accounts DET0838 Detection of Virtual Private Server DET0852 Detection of Tool DET0854 Detection of Virtual Private Server DET0863 Detection of Domains +6 more

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (8)

DET0066 User Execution – Malicious Link (click →... DET0202 Behavioral Detection of Windows Command... DET0294 User Execution – Malicious File via down... DET0364 Behavioral Detection Strategy for WMI Ex... DET0421 Detection Strategy for System Services S... +3 more

Installation (24)

DET0003 T1136.002 Detection Strategy - Domain Ac... DET0007 Detection of Domain Trust Discovery via... DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0085 Credential Dumping from SAM via Registry... +19 more

Command & Control (15)

DET0014 Detection of Data Staging Prior to Exfil... DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0118 Exploitation of Remote Services – multi-... DET0183 Detection Strategy for Lateral Tool Tran... +10 more

Actions on Objectives (22)

DET0021 Behavioral Detection for Service Stop ac... DET0098 Detect abuse of Windows BITS Jobs for do... DET0117 Detection of Masqueraded Tasks or Servic... DET0140 Behavioral Detection of Malicious File D... DET0146 Detection of Data Destruction Across Pla... +17 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

Wizard Spider

Type: Unknown Active
UNC1878 TEMP.MixMaster Grim Spider FIN12 GOLD BLACKBURN +27 more
Infrastructure 27 IOC(s)
50%
Domain
cisa.gov TEMP.Veles datasecuritytoday.com Salesforce.com NLog.config +22
Artifacts (13)
info@redcanary.com rocke@live.cn taskeng.exe regsvr32.exe wscpy.exe mshta.exe +7
Capability
81%
82 technique(s) 53 tool(s)/malware 4 CVE(s)
AdFind Akira Anchor AppleJeus BASTA ransomware Bazar BazarBackdoor Beacon +45
collection
T1005 T1074 T1074.001 T1560.001
command and control
T1071 T1071.001 T1105 T1571
credential access
T1003.001 T1003.002 T1003.003 T1552.006 +3
defense impairment
T1112 T1222.001 T1553.002 T1685
Victim
70%

Targeted Sectors

defense financial-services government healthcare telecommunications manufacturing education non-profit media critical-infrastructure energy pharmaceutical aviation hospitality aerospace retail information-technology think-tank transportation mining chemical gaming legal-services nuclear entertainment oil-gas maritime construction utilities

Targeted Countries

GB US CN RU IR VN JP IL AU SA PK TW DE AE UA SG KR IN CA BY TR FR MX ES PL IT RO NG KP LB AZ KZ NL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

AdFind Akira Anchor
3 Delivery

Capability (Techniques)

T1566.001 T1566.002

Capability (Malware)

AdFind Akira Anchor
4 Exploitation

Capability (Malware)

AdFind Akira Anchor
5 Installation

Capability (Malware)

AdFind Akira Anchor
6 Command & Control

Capability (Malware)

AdFind Akira Anchor
7 Actions on Objectives

Capability (Malware)

AdFind Akira Anchor
Leaving Threaticon

This link opens an external site that isn't part of the platform.